Fix indentation for all pages

docs/modules/ROOT/pages/README.adoc

@@ -3,10 +3,10 @@
 include::intro.adoc[]
 
 [[features]]
-== Features
+= Features
 
 [[spring-cloud-vault-config-client]]
-=== Spring Cloud Vault Config Client
+== Spring Cloud Vault Config Client
 
 Specifically for Spring applications:
 
@@ -31,15 +31,15 @@ Specifically for Spring applications:
 * Bootstrap application context: a parent context for the main application that can be trained to do anything.
 
 [[quick-start]]
-== Quick Start
+= Quick Start
 
 include::quickstart.adoc[]
 
 [[building]]
-== Building
+= Building
 
 [[build-requirements-for-vault]]
-=== Build requirements for Vault
+== Build requirements for Vault
 
 Spring Cloud Vault Config requires SSL certificates and a running Vault instance listening on `localhost:8200`.
 Certificates and the Vault setup are scripted, the scripts are located in `src/test/bash`.
@@ -70,6 +70,6 @@ This script requires ruby and the asciidoctor gem installed (`gem install asciid
 include::https://raw.githubusercontent.com/spring-cloud/spring-cloud-build/master/docs/src/main/asciidoc/building.adoc[]
 
 [[contributing]]
-== Contributing
+= Contributing
 
 include::https://raw.githubusercontent.com/spring-cloud/spring-cloud-build/master/docs/src/main/asciidoc/contributing.adoc[]

docs/modules/ROOT/pages/appendix.adoc

@@ -1,7 +1,7 @@
 :numbered!:
 [appendix]
 [[common-application-properties]]
-== Common application properties
+= Common application properties
 
 include::_attributes.adoc[]
 

docs/modules/ROOT/pages/authentication.adoc

@@ -1,12 +1,12 @@
 [[vault.config.authentication]]
-== Authentication methods
+= Authentication methods
 
 Different organizations have different requirements for security and authentication.
 Vault reflects that need by shipping multiple authentication methods.
 Spring Cloud Vault supports token and AppId authentication.
 
 [[vault.config.authentication.token]]
-=== Token authentication
+== Token authentication
 
 Tokens are the core method for authentication within Vault.
 Token authentication requires a static token to be provided using the configuration.
@@ -35,7 +35,7 @@ See also:
 * https://www.vaultproject.io/docs/commands/token-helper[Vault Documentation: CLI default to ~/.vault-token]
 
 [[vault.config.authentication.vault-agent]]
-=== Vault Agent authentication
+== Vault Agent authentication
 
 Vault ships a sidecar utility with Vault Agent since version 0.11.0. Vault Agent implements the functionality of Spring Vault's `SessionManager`
 with its Auto-Auth feature.
@@ -59,7 +59,7 @@ and `SessionManager`.
 See also: https://www.vaultproject.io/docs/agent/index.html[Vault Documentation: Agent]
 
 [[vault.config.authentication.appid]]
-=== AppId authentication
+== AppId authentication
 
 Vault supports https://www.vaultproject.io/docs/auth/app-id.html[AppId]
 authentication that consists of two hard to guess tokens.
@@ -126,7 +126,7 @@ NOTE: The Mac address is specified uppercase and without colons.
 Including the line break of `echo` leads to a different hash value so make sure to include the `-n` flag.
 
 [[custom-userid]]
-==== Custom UserId
+=== Custom UserId
 
 The UserId generation is an open mechanism.
 You can set
@@ -165,7 +165,7 @@ public class MyUserIdMechanism implements AppIdUserIdMechanism {
 See also: https://www.vaultproject.io/docs/auth/app-id.html[Vault Documentation: Using the App ID auth backend]
 
 [[approle-authentication]]
-=== AppRole authentication
+== AppRole authentication
 
 https://www.vaultproject.io/docs/auth/app-id.html[AppRole] is intended for machine authentication, like the deprecated (since Vault 0.6.1) <<vault.config.authentication.appid>>.
 AppRole authentication consists of two hard to guess (secret) tokens: RoleId and SecretId.
@@ -247,7 +247,7 @@ SecretId can be omitted if AppRole is configured without requiring SecretId (See
 See also: https://www.vaultproject.io/docs/auth/approle.html[Vault Documentation: Using the AppRole auth backend]
 
 [[vault.config.authentication.awsec2]]
-=== AWS-EC2 authentication
+== AWS-EC2 authentication
 
 The https://www.vaultproject.io/docs/auth/aws-ec2.html[aws-ec2]
 auth backend provides a secure introduction mechanism for AWS EC2 instances, allowing automated retrieval of a Vault token.
@@ -312,7 +312,7 @@ An empty nonce defaults to nonce generation
 See also: https://www.vaultproject.io/docs/auth/aws.html[Vault Documentation: Using the aws auth backend]
 
 [[vault.config.authentication.awsiam]]
-=== AWS-IAM authentication
+== AWS-IAM authentication
 
 The https://www.vaultproject.io/docs/auth/aws-ec2.html[aws] backend provides a secure authentication mechanism for AWS IAM roles, allowing the automatic authentication with vault based on the current IAM role of the running application.
 Unlike most Vault authentication backends, this backend does not require first-deploying, or provisioning security-sensitive credentials (tokens, username/password, client certificates, etc.).
@@ -362,7 +362,7 @@ AWS-IAM requires the AWS Java SDK v2 dependency (`software.amazon.awssdk:auth`)
 See also: https://www.vaultproject.io/docs/auth/aws.html[Vault Documentation: Using the aws auth backend]
 
 [[vault.config.authentication.azuremsi]]
-=== Azure MSI authentication
+== Azure MSI authentication
 
 The https://www.vaultproject.io/docs/auth/azure.html[azure]
 auth backend provides a secure introduction mechanism for Azure VM instances, allowing automated retrieval of a Vault token.
@@ -409,7 +409,7 @@ See also:
 * https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service[Azure Documentation: Azure Instance Metadata Service]
 
 [[vault.config.authentication.clientcert]]
-=== TLS certificate authentication
+== TLS certificate authentication
 
 The `cert` auth backend allows authentication using SSL/TLS client certificates that are either signed by a CA or self-signed.
 
@@ -436,7 +436,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/auth/cert.html[Vault Documentation: Using the Cert auth backend]
 
 [[vault.config.authentication.cubbyhole]]
-=== Cubbyhole authentication
+== Cubbyhole authentication
 
 Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow.
 Cubbyhole authentication uses tokens as primary login method.
@@ -479,7 +479,7 @@ See also:
 * https://www.vaultproject.io/docs/concepts/response-wrapping.html[Vault Documentation: Response Wrapping]
 
 [[vault.config.authentication.gcpgce]]
-=== GCP-GCE authentication
+== GCP-GCE authentication
 
 The https://www.vaultproject.io/docs/auth/gcp.html[gcp]
 auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.
@@ -526,7 +526,7 @@ See also:
 * https://cloud.google.com/compute/docs/instances/verifying-instance-identity[GCP Documentation: Verifying the Identity of Instances]
 
 [[vault.config.authentication.gcpiam]]
-=== GCP-IAM authentication
+== GCP-IAM authentication
 
 The https://www.vaultproject.io/docs/auth/gcp.html[gcp]
 auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.
@@ -591,7 +591,7 @@ See also:
 
 [[vault.authentication.gcpiam]]
 [[vault.config.authentication.kubernetes]]
-=== Kubernetes authentication
+== Kubernetes authentication
 
 Kubernetes authentication mechanism (since Vault 0.8.3) allows to authenticate with Vault using a Kubernetes Service Account Token.
 The authentication is role based and the role is bound to a service account name and a namespace.
@@ -622,7 +622,7 @@ See also:
 * https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/[Kubernetes Documentation: Configure Service Accounts for Pods]
 
 [[vault.config.authentication.pcf]]
-=== Pivotal CloudFoundry authentication
+== Pivotal CloudFoundry authentication
 
 The https://www.vaultproject.io/docs/auth/pcf.html[pcf]
 auth backend provides a secure introduction mechanism for applications running within Pivotal's CloudFoundry instances allowing automated retrieval of a Vault token.
@@ -666,7 +666,7 @@ NOTE: PCF authentication requires BouncyCastle (bcpkix-jdk15on) to be on the cla
 See also: https://www.vaultproject.io/docs/auth/pcf.html[Vault Documentation: Using the pcf auth backend]
 
 [[vault.config.acl]]
-== ACL Requirements
+= ACL Requirements
 
 This section explains which paths are accessed by Spring Vault so you can derive your policy declarations from the required capabilities.
 
@@ -693,17 +693,17 @@ This section explains which paths are accessed by Spring Vault so you can derive
 See also https://www.vaultproject.io/guides/identity/policies.
 
 [[authentication]]
-=== Authentication
+== Authentication
 
 Login: `POST auth/$authMethod/login`
 
 [[keyvalue-mount-discovery]]
-=== KeyValue Mount Discovery
+== KeyValue Mount Discovery
 
 `GET sys/internal/ui/mounts/$mountPath`
 
 [[secretleasecontainer]]
-=== SecretLeaseContainer
+== SecretLeaseContainer
 
 `SecretLeaseContainer` uses different paths depending on the configured lease endpoint.
 
@@ -718,7 +718,7 @@ Login: `POST auth/$authMethod/login`
 * Renewal: `PUT sys/leases/renew`
 
 [[session-management]]
-=== Session Management
+== Session Management
 
 * Token lookup: `GET auth/token/lookup-self`
 * Renewal: `POST auth/token/renew-self`

docs/modules/ROOT/pages/config-data.adoc

@@ -1,5 +1,5 @@
 [[vault.configdata]]
-== ConfigData API
+= ConfigData API
 
 Spring Boot provides since version 2.4 a ConfigData API that allows the declaration of configuration sources and importing these as property sources.
 
@@ -11,7 +11,7 @@ NOTE: You can enable the bootstrap context either by setting the configuration p
 Using the boostrap context should be only rarely required hence we recommend using the Config Data API for more flexibility regarding property source ordering.
 
 [[vault.configdata.locations]]
-=== ConfigData Locations
+== ConfigData Locations
 
 You can mount Vault configuration through one or more `PropertySource` that are materialized from Vault.
 Spring Cloud Vault supports two config locations:
@@ -56,7 +56,7 @@ NOTE: Prefixes are added as-is to all property names returned by Vault. If you w
 ====
 
 [[vault.configdata.location.optional]]
-=== Conditionally enable/disable Vault Configuration
+== Conditionally enable/disable Vault Configuration
 
 In some cases, it can be required to launch an application without Vault. You can express whether a Vault config location should be optional or mandatory (default) through the location string:
 
@@ -69,7 +69,7 @@ NOTE: Vault context paths that cannot be found (HTTP Status 404) are skipped reg
 
 
 [[vault.configdata.customization]]
-=== Infrastructure Customization
+== Infrastructure Customization
 
 Spring Cloud Vault requires infrastructure classes to interact with Vault. When not using the ConfigData API (meaning that you haven't specified `spring.config.import=vault://` or a contextual Vault path), Spring Cloud Vault defines its beans through `VaultAutoConfiguration` and `VaultReactiveAutoConfiguration`.
 Spring Boot bootstraps the application before a Spring Context is available. Therefore `VaultConfigDataLoader` registers beans itself to propagate these later on into the application context.

docs/modules/ROOT/pages/new-features.adoc

@@ -1,10 +1,10 @@
 [[new-noteworthy]]
-== New & Noteworthy
+= New & Noteworthy
 
 This section briefly covers items that are new and noteworthy in the latest releases.
 
 [[new-in-3.0.0]]
-=== New in Spring Cloud Vault 3.0
+== New in Spring Cloud Vault 3.0
 
 * Migration of `PropertySource` initialization from Spring Cloud's Bootstrap Context to Spring Boot's <<vault.configdata,ConfigData API>>.
 * Support for the <<vault.config.backends.couchbase>> backend.

docs/modules/ROOT/pages/other-topics.adoc

@@ -1,5 +1,5 @@
 [[service-registry-configuration]]
-== Service Registry Configuration
+= Service Registry Configuration
 
 You can use a `DiscoveryClient` (such as from Spring Cloud Consul) to locate a Vault server by setting spring.cloud.vault.discovery.enabled=true (default `false`).
 The net result of that is that your apps need a application.yml (or an environment variable) with the appropriate discovery configuration.
@@ -22,7 +22,7 @@ spring.cloud.vault.discovery:
 ====
 
 [[vault.config.fail-fast]]
-== Vault Client Fail Fast
+= Vault Client Fail Fast
 
 In some cases, it may be desirable to fail startup of a service if it cannot connect to the Vault Server.
 If this is the desired behavior, set the bootstrap configuration property
@@ -37,7 +37,7 @@ spring.cloud.vault:
 ====
 
 [[vault.config.namespaces]]
-== Vault Enterprise Namespace Support
+= Vault Enterprise Namespace Support
 
 Vault Enterprise allows using namespaces to isolate multiple Vaults on a single Vault server.
 Configuring a namespace by setting
@@ -58,7 +58,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/enterprise/namespaces/index.html[Vault Enterprise: Namespaces]
 
 [[vault.config.ssl]]
-== Vault Client SSL configuration
+= Vault Client SSL configuration
 
 SSL can be configured declaratively by setting various properties.
 You can set either `javax.net.ssl.trustStore` to configure JVM-wide SSL settings or `spring.cloud.vault.ssl.trust-store`
@@ -87,7 +87,7 @@ SSL-secured Vault communication will validate the Vault SSL certificate with the
 Please note that configuring `spring.cloud.vault.ssl.*` can be only applied when either Apache Http Components or the OkHttp client is on your class-path.
 
 [[vault-lease-renewal]]
-== Lease lifecycle management (renewal and revocation)
+= Lease lifecycle management (renewal and revocation)
 
 With every secret, Vault creates a lease:
 metadata containing information such as a time duration, renewability, and more.
@@ -132,7 +132,7 @@ Legacy for vault versions before 0.8 and SysLeases for later.
 See also: https://www.vaultproject.io/docs/concepts/lease.html[Vault Documentation: Lease, Renew, and Revoke]
 
 [[vault-session-lifecycle]]
-== Session token lifecycle management (renewal, re-login and revocation)
+= Session token lifecycle management (renewal, re-login and revocation)
 
 A Vault session token (also referred to as `LoginToken`) is quite similar to a lease as it has a TTL, max TTL, and may expire.
 Once a login token expires, it cannot be used anymore to interact with Vault.

docs/modules/ROOT/pages/quickstart.adoc

@@ -127,7 +127,7 @@ where the "application" is injected as the `spring.application.name` in the
 Properties retrieved from Vault will be used "as-is" without further prefixing of the property names.
 
 [[client-side-usage]]
-== Client Side Usage
+= Client Side Usage
 
 To use these features in an application, just build it as a Spring Boot application that depends on `spring-cloud-vault-config` (e.g. see the test cases).
 Example Maven configuration:
@@ -233,7 +233,7 @@ Instead, Spring Cloud Vault favors Spring Boot's Config Data API which allows im
 You can enable the bootstrap context either by setting the configuration property `spring.cloud.bootstrap.enabled=true` or by including the dependency `org.springframework.cloud:spring-cloud-starter-bootstrap`.
 
 [[authentication]]
-=== Authentication
+== Authentication
 
 Vault requires an https://www.vaultproject.io/docs/concepts/auth.html[authentication mechanism] to https://www.vaultproject.io/docs/concepts/tokens.html[authorize client requests].
 

docs/modules/ROOT/pages/secret-backends.adoc

@@ -1,10 +1,10 @@
 [[vault.config.backends]]
-== Secret Backends
+= Secret Backends
 
 [[vault.config.backends.kv]]
 [[vault.config.backends.generic]]
 [[vault.config.backends.kv.versioned]]
-=== Key-Value Backend
+== Key-Value Backend
 
 Spring Cloud Vault supports both Key-Value secret backends, the versioned (v2) and unversioned (v1).
 The key-value backend allows storage of arbitrary values as key-value store.
@@ -74,7 +74,7 @@ See also:
 * https://www.vaultproject.io/docs/secrets/kv/kv-v2.html[Vault Documentation: Using the KV Secrets Engine - Version 2 (versioned key-value backend)]
 
 [[vault.config.backends.consul]]
-=== Consul
+== Consul
 
 Spring Cloud Vault can obtain credentials for HashiCorp Consul.
 The Consul integration requires the `spring-cloud-vault-config-consul`
@@ -121,7 +121,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/consul/index.html[Vault Documentation: Setting up Consul with Vault]
 
 [[vault.config.backends.rabbitmq]]
-=== RabbitMQ
+== RabbitMQ
 
 Spring Cloud Vault can obtain credentials for RabbitMQ.
 
@@ -172,7 +172,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/rabbitmq/index.html[Vault Documentation: Setting up RabbitMQ with Vault]
 
 [[vault.config.backends.aws]]
-=== AWS
+== AWS
 
 Spring Cloud Vault can obtain credentials for AWS.
 
@@ -256,7 +256,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/aws/index.html[Vault Documentation: Setting up AWS with Vault]
 
 [[vault.config.backends.database-backends]]
-== Database backends
+= Database backends
 
 Vault supports several database secret backends to generate database credentials dynamically based on configured roles.
 This means services that need to access a database no longer need to configure credentials: they can request them from Vault, and use Vault's leasing mechanism to more easily roll keys.
@@ -295,7 +295,7 @@ Make sure to specify the appropriate backend path, e.g. `spring.cloud.vault.mysq
 NOTE: Enabling multiple JDBC-compliant databases will generate credentials and store them by default in the same property keys hence property names for JDBC secrets need to be configured separately.
 
 [[vault.config.backends.database]]
-=== Database
+== Database
 
 Spring Cloud Vault can obtain credentials for any database listed at
 https://www.vaultproject.io/api/secret/databases/index.html.
@@ -324,7 +324,7 @@ spring.cloud.vault:
 ====
 
 [[vault.config.backends.databases]]
-=== Multiple Databases
+== Multiple Databases
 
 Sometimes, credentials for a single database isn't sufficient because an application might connect to two or more databases of the same kind.
 Beginning with version 3.0.5, Spring Vault supports the configuration of multiple database secret backends under the `spring.cloud.vault.databases.*` namespace.
@@ -364,7 +364,7 @@ WARNING: Spring Cloud Vault does not support getting new credentials and configu
 That is, if `max_ttl` of the Database role in Vault is set to `24h` that means that 24 hours after your application has started it can no longer authenticate with the database.
 
 [[vault.config.backends.cassandra]]
-=== Apache Cassandra
+== Apache Cassandra
 
 NOTE: The `cassandra` backend has been deprecated in Vault 0.7.1 and it is recommended to use the `database` backend and mount it as `cassandra`.
 
@@ -400,7 +400,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/cassandra/index.html[Vault Documentation: Setting up Apache Cassandra with Vault]
 
 [[vault.config.backends.couchbase]]
-=== Couchbase Database
+== Couchbase Database
 
 Spring Cloud Vault can obtain credentials for Couchbase.
 The integration can be enabled by setting
@@ -434,7 +434,7 @@ spring.cloud.vault:
 See also: https://github.com/hashicorp/vault-plugin-database-couchbase[Couchbase Database Plugin Documentation]
 
 [[vault.config.backends.elasticsearch]]
-=== Elasticsearch
+== Elasticsearch
 
 Spring Cloud Vault can obtain since version 3.0 credentials for Elasticsearch.
 The integration can be enabled by setting
@@ -468,7 +468,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/databases/elasticdb[Vault Documentation: Setting up Elasticsearch with Vault]
 
 [[vault.config.backends.mongodb]]
-=== MongoDB
+== MongoDB
 
 NOTE: The `mongodb` backend has been deprecated in Vault 0.7.1 and it is recommended to use the `database` backend and mount it as `mongodb`.
 
@@ -504,7 +504,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/mongodb/index.html[Vault Documentation: Setting up MongoDB with Vault]
 
 [[vault.config.backends.mysql]]
-=== MySQL
+== MySQL
 
 NOTE: The `mysql` backend has been deprecated in Vault 0.7.1 and it is recommended to use the `database` backend and mount it as `mysql`.
 Configuration for `spring.cloud.vault.mysql` will be removed in a future version.
@@ -541,7 +541,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/mysql/index.html[Vault Documentation: Setting up MySQL with Vault]
 
 [[vault.config.backends.postgresql]]
-=== PostgreSQL
+== PostgreSQL
 
 NOTE: The `postgresql` backend has been deprecated in Vault 0.7.1 and it is recommended to use the `database` backend and mount it as `postgresql`.
 Configuration for `spring.cloud.vault.postgresql` will be removed in a future version.
@@ -578,7 +578,7 @@ spring.cloud.vault:
 See also: https://www.vaultproject.io/docs/secrets/postgresql/index.html[Vault Documentation: Setting up PostgreSQL with Vault]
 
 [[vault.config.backends.configurer]]
-== Customize which secret backends to expose as PropertySource
+= Customize which secret backends to expose as PropertySource
 
 Spring Cloud Vault uses property-based configuration to create ``PropertySource``s for key-value and discovered secret backends.
 
@@ -615,7 +615,7 @@ application.addBootstrapper(VaultBootstrapper.fromConfigurer(new CustomizationBe
 ====
 
 [[vault.config.backends.custom]]
-== Custom Secret Backend Implementations
+= Custom Secret Backend Implementations
 
 Spring Cloud Vault ships with secret backend support for the most common backend integrations.
 You can integrate with any kind of backend by providing an implementation that describes how to obtain data from the backend you want to use and how to surface data provided by that backend by providing a `PropertyTransformer`.